Cookies and storage

Cookies and storageAt a glance

The dashboard uses two cookies of our own: one keeps you signed in, one recognises your browser. It sets no advertising cookies.

Display choices are kept in your browser's local storage.

On publishers' sites, the ad tag and our ad domain store frequency counters and a visitor id in the visitor's browser.

1. The dashboard

Sign-in cookie (np_session): keeps you signed in. It lasts 14 days and is removed when you sign out.

Browser cookie (np_dev): a random id for this browser. It lasts 395 days. We use it to warn you when your account is opened from a browser it has never used, to show your sign-in history, and to notice several accounts used from one browser. A second small cookie (np_dev_d, 395 days) only records that the id was saved for our whole domain.

Both are set by us, cannot be read by scripts on the page, and are needed for the service. The browser cookie is first set when you sign up or try to sign in.

2. Local storage in the dashboard and on our siteKept in your browser until you clear it, and not sent to us with each request:

Language, light or dark theme, the layout and width of the menu, the columns you chose in tables, and the time zone of your statistics.

Whether you last worked as advertiser or publisher.

The referral code of the link that brought you, so it can be applied when you sign up.

That you closed the cookie notice.

A copy of the site's name, logo and public settings, so pages load faster.

3. On publishers' sites: the ad tagThe ad tag runs on the publisher's page. In that site's local storage it keeps:

The times of the ads it opened in the last 24 hours on that zone, so a visitor is not shown more than the zone's limit.

With the self-hosted version of the tag: the list of our ad domains, refreshed once a day.

When an ad opens, the tag sends us a short code worked out from the screen size, time zone, language and similar settings, the time spent on the page before the click, and whether the tab was hidden. The code is used to spot one device sending many visits.4. On publishers' sites: our ad domainWhen an ad is served, our ad domain sets cookies in the visitor's browser:

A counter per zone (24 hours): how many ads the visitor got from that zone.

A counter per campaign that has a frequency limit, for the period the advertiser chose: how many times the visitor saw that campaign.

A random visitor id (30 days). It is stored with the click, and lets a campaign recognise a visitor who already completed its offer.

On some visits a short check page opens first. It tests whether the browser is automated and whether storage works, by writing a test value and removing it at once. On a sample of visits a second short page loads a script from Adscore, a bot-detection service, which runs its own checks in the visitor's browser.5. Consent signalsIf the publisher's site runs a consent tool, the tag reads the consent signals it offers and passes them to us and to the demand partners that bid. The tag does not wait for them: the storage and cookies above are used either way. A publisher whose visitors' law requires consent must get it before loading the tag.6. What publishers must tell their visitorsA publisher using Adqur must say in their own privacy or cookie notice that third-party ads are shown, that the items in sections 3 and 4 are stored in the visitor's browser, and that the visit is recorded as described in our Privacy policy.7. Your choicesYou can clear or block cookies and local storage in your browser. Without the sign-in cookie you cannot stay signed in. Blocking the ad domain's cookies does not stop ads; the frequency limits then work less well.